On 19 January 2026, Bank Negara Malaysia (BNM) imposed Administrative Monetary Penalties (AMP)^[1] of RM1,040,000 on Zurich General Insurance Malaysia Berhad (ZGIMB) and RM520,000 on Zurich General Takaful Malaysia Berhad (ZGTMB) (collectively referred to as Zurich) for failure to comply with requirements relating to targeted financial sanctions (TFS).^[2]

As reporting institutions (RIs), Zurich is required to update the sanctions database without delay upon publication of the Domestic List^[3] and conduct sanctions screening on existing, potential or new customers against the Domestic List and United Nations Security Council Resolutions (UNSCR) List^[4] as part of its customer due diligence process. RIs must also ascertain and make further inquiries to determine whether the potential match is a true match. Upon determination of any true match, RIs are required to freeze the customer’s funds and submit a report to BNM and Royal Malaysia Police immediately. This is essential to protect RIs and the broader financial system from being abused for terrorism financing activities.

The breaches were discovered by BNM based on Zurich’s reports on the onboarding of several specified entities, listed in the Domestic List, as its customers. This arose from Zurich’s failure to update its sanctions database without delay, which resulted in the sanctions screening being conducted against an outdated database. Zurich also failed to ascertain potential matches and make further inquiries to determine whether the potential matches as true matches. Additionally, ZGIMB failed to freeze the customer’s funds and submit a report to BNM immediately upon determination that it was in possession of or in control of funds with respect to one specified entity.

These breaches were attributed to gaps in Zurich’s sanctions screening systems and standard operating procedures (SOPs), as well as lack of staff oversight and awareness. Zurich has since taken remedial measures by enhancing its SOPs and conducting refresher training for relevant staff to ensure compliance with TFS requirements. 

In deciding the AMP to be imposed, relevant aggravating and mitigating factors have been considered. These include the severity of the breaches and Zurich’s:

1. lack of reasonable care in ensuring compliance with the TFS requirements;
2. past compliance record; and
3. post-misconduct behaviour, including the effectiveness of remedial actions to prevent the recurrence of breaches.

On 26 January 2026, ZGIMB paid RM1,040,000 and ZGTMB paid RM520,000 for the AMP imposed by BNM.

BNM requires all RIs to comply with TFS requirements. BNM will not hesitate to take appropriate supervisory and/or enforcement actions should any RIs fail to meet its legal and/or regulatory requirements.

The enforcement actions taken against Zurich is in line with the approach and processes outlined in BNM’s published Enforcement Approach.

^[1] BNM imposed the AMP pursuant to section 234(3)(b)(i) of the Financial Services Act 2013 (FSA) and section 245(3)(b)(i) of the Islamic Financial Services Act 2013 (IFSA).

^[2] For ZGIMB, these requirements are set out under section 48(1)(a) of the FSA read together with paragraphs 27.3.5, 27.3.7, 27.4.1 (read together with paragraph 27.4.3), 27.4.5, 27.4.6, 27.6.1 and 27.7.1 of the Anti-Money Laundering, Countering Financing of Terrorism and Targeted Financial Sanctions for Financial Institutions Policy Document (AML/CFT and TFS for FIs PD).

For ZGTMB, these requirements are set out under section 58(1)(a) of the IFSA read together with paragraphs 27.3.5, 27.3.7, 27.4.1 (read together with paragraph 27.4.3), 27.4.5 and 27.4.6 of the AML/CFT and TFS for FIs PD.

Note: The AML/CFT and TFS for FIs PD was in effect from 1 January 2020 to 5 February 2024 and has since been superseded by the Anti-Money Laundering, Countering Financing of Terrorism, Countering Proliferation Financing and Targeted Financial Sanctions for Financial Institutions Policy Document (AML/CFT/CPF and TFS for FIs PD), which took effect on 6 February 2024. These requirements are preserved under paragraphs 27.3.5, 27.3.7, 27.4.1 (read together with paragraph 27.4.5), 27.4.8, 27.4.9, 27.6.1 and 27.7.1 of the AML/CFT/CPF and TFS for FIs PD.

^[3] The Domestic List is a list of names and particulars of specified entities declared by the Minister of Home Affairs under relevant subsidiary legislation made under section 66B(1) of the Anti-Money Laundering, Anti-Terrorism Financing and Proceeds of Unlawful Activities Act 2001 (AMLA).

^[4] The UNSCR List is a list of names and particulars of persons as designated by the United Nations Security Council (UNSC) or its relevant Sanctions Committee pursuant to the relevant UNSCR and are deemed as specified entities by virtue of section 66C(2) of the AMLA.